PT-2025-53104

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a memory leak in the vhost-vdpa subsystem related to IOTLB I/O Translation Lookaside Buffer management. Prior to commit 3d5698793897, the vhost vdpa iotlb unmap...

Malicious code in trial-guard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16f74d3903fd133c053441c95d9b7a755cbaf7c69050b9a883a2162e3e7b0dfc The package trial-guard was found to contain malicious code. Source: ghsa-malware 3106ed572562306cb0caa1d2219da59b90053db9127323b84442fa2c119d4c05 An...

PT-2025-52754

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to DSA Distributed Switch Architecture and Microchip network devices. Specifically, the ksz irq free function may be called on an uninitialized...

CVE-2023-53964

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated vulnerability in the /usr/cgi-bin/restorefactory.cgi endpoint that allows remote attackers to reset device configuration. Attackers can send a POST request to the endpoint with specific data to trigger a factory reset and bypass...

CVE-2023-53963

CVE-2023-53963 affects SOUND4 IMPACT/FIRST/PULSE/Eco v2.x and describes an unauthenticated OS command injection via the password parameter in login.php and index.php, enabling remote command execution with web server privileges. Public references document a PoC and multiple exploits (e.g., Exploi...

CVE-2023-53964

The CVE-2023-53964 entry concerns SOUND4 IMPACT/FIRST/PULSE/Eco v2.x. The vulnerability is an unauthenticated factory-reset flaw in the /usr/cgi-bin/restorefactory.cgi endpoint that allows remote attackers to trigger a device factory reset by sending a crafted POST request, bypassing authenticati...

CVE-2023-53963 SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Remote Command Injection

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands through the 'password' parameter. Attackers can exploit the login.php and index.php scripts by injecting shell commands via the...

CVE-2023-53962 SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Directory Traversal File Write

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated directory traversal vulnerability that allows remote attackers to write arbitrary files through the 'upgfile' parameter in upload.cgi. Attackers can exploit the vulnerability by sending crafted multipart form-data POST requests with...

AZL-72898 CVE-2025-68334 affecting package kernel for versions less than 6.6.130.1-1

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Add support for Van Gogh SoC The ROG Xbox Ally non-X SoC features a similar architecture to the Steam Deck. While the Steam Deck supports S3 s2idle causes a crash, this support was dropped by the Xbox Ally...

CVE-2025-68334

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Add support for Van Gogh SoC The ROG Xbox Ally non-X SoC features a similar architecture to the Steam Deck. While the Steam Deck supports S3 s2idle causes a crash, this support was dropped by the Xbox Ally...

CVE-2025-68334

The CVE-2025-68334 entry describes a Linux kernel issue in platform/x86/amd/pmc related to Van Gogh SoC support. The root cause is a missing handler for the Xbox Ally/Van Gogh-like suspend path, which prevents proper S3/S0ix transitions and leads to the AMD GPU driver crash during resume due to a...

CVE-2025-8065

A stack-based buffer overflow vulnerability was identified in the ONVIF SOAP XML Parser in Tapo C200 v3 and C520WS v2.6. When processing XML tags with namespace prefixes, the parser fails to validate the prefix length before copying it to a fixed-size stack buffer. It allowed a crafted SOAP reque...

CVE-2025-50681

igmpproxy 0.4 before commit 2b30c36 allows remote attackers to cause a denial of service application crash via a crafted IGMPv3 membership report packet with a malicious source address. Due to insufficient validation in the recvigmp function in src/igmpproxy.c, an invalid group record type can...

CVE-2025-14884

A vulnerability was detected in D-Link DIR-605 202WWB03. Affected by this issue is some unknown functionality of the component Firmware Update Service. Performing manipulation results in command injection. The attack can be initiated remotely. The exploit is now public and may be used. This...

EUVD-2025-204563

ArcSearch for iOS versions prior to 1.45.2 could display a different domain in the address bar than the content being shown after an iframe-triggered URI-scheme navigation, increasing spoofing risk...

MAL-2025-192661 Malicious code in adel-xnetgpt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f85b321aa51079c32d9640eb5619d6350f409dc14f26141a99a5744932ddee14 The package adel-xnetgpt was found to contain malicious code. Source: ghsa-malware 0ebdfb3056af9b8e58d8ce4bc938a77b985744ece2a3de14f4b691d2b97ca3ad A...

Malicious code in @sodexo-connect/sap-cdc-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4e047fc494b2206648c16c1e980cbf3aed51b9c27a8a9287cabfa869aab9095 The package @sodexo-connect/sap-cdc-client was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-204539

Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. The handleQueryUserOnlineStatusesRequest method in UserServiceController.java allows any authenticated user to query the online status, device information, an...

CVE-2025-50681

igmpproxy 0.4 before commit 2b30c36 allows remote attackers to cause a denial of service application crash via a crafted IGMPv3 membership report packet with a malicious source address. Due to insufficient validation in the recvigmp function in src/igmpproxy.c, an invalid group record type can...

CVE-2025-50681

igmpproxy 0.4 before commit 2b30c36 allows remote attackers to cause a denial of service application crash via a crafted IGMPv3 membership report packet with a malicious source address. Due to insufficient validation in the recvigmp function in src/igmpproxy.c, an invalid group record type can...